• Event List
• Common Event Properties
• Examples

This page documents the full list of events that are surfaced with the workspace audit logging feature. This list is subject to change, and more events will be added over time.

Audit logs follow version 1.7.0 of the Open Cybersecurity Schema Framework (OCSF), a standardized, platform-agnostic schema designed for security event data.

Event List

This list contains all of the events that are currently available; events are uniquely identified by their numeric activity_id and their activity_name. Each event also belongs to a specific class (identified by the class_uid and class_name), and classes are grouped into different categories. 

For more information on the data contained within each event, you can refer to the linked documentation on the OCSF website to see the full schema for each class, as well as the list of common properties and examples for some Read-specific details further below.

*Session refers to a specific meeting report.

Common Event Properties

Examples

Sign-in event ("Logon"):

{
   "activity_id":1,
   "activity_name":"Logon",
   "actor":{
      "user":{
         "email_addr":"ada@read.ai",
         "uid":"1234567890"
      }
   },
   "auth_factors":[
      {
         "factor_type_id":0,
         "provider":"read"
      }
   ],
   "category_name":"Identity & Access Management",
   "category_uid":3,
   "class_name":"Authentication",
   "class_uid":3002,
   "message":"Authentication login for user 1234567890",
   "metadata":{
      "product":{
         "name":"Read AI"
      },
      "tenant_id":"01K820PAE0S32BVWXDFN5NZR1X",
      "uid":"f296be4f-a404-49e2-8c0e-412712665bb7",
      "version":"1.7.0"
   },
   "observables":[
      {
         "type":"IP Address",
         "type_id":2,
         "value":"123.123.123.123"
      },
      {
         "type":"HTTP User-Agent",
         "type_id":16,
         "value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36"
      }
   ],
   "severity":"Low",
   "severity_id":2,
   "status":"Success",
   "status_id":1,
   "time":"2026-03-13T16:00:00.785969",
   "type_uid":300201,
   "user":{
      "email_addr":"ada@read.ai",
      "full_name":"Ada Aiken",
      "uid":"1234567890"
   }
}

 Sign-out event ("Logoff"):

{
   "activity_id":2,
   "activity_name":"Logoff",
   "actor":{
      "user":{
         "email_addr":"ada@read.ai",
         "uid":"1234567890"
      }
   },
   "category_name":"Identity & Access Management",
   "category_uid":3,
   "class_name":"Authentication",
   "class_uid":3002,
   "message":"Authentication logout for user 1234567890",
   "metadata":{
      "product":{
         "name":"Read AI"
      },
      "tenant_id":"01K820PAE0S32BVWXDFN5NZR1X",
      "uid":"5ed946d0-ef7b-408c-b756-92638d0dc385",
      "version":"1.7.0"
   },
   "observables":[
      {
         "type":"IP Address",
         "type_id":2,
         "value":"123.123.123.123"
      },
      {
         "type":"HTTP User-Agent",
         "type_id":16,
         "value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36"
      }
   ],
   "severity":"Low",
   "severity_id":2,
   "status":"Success",
   "status_id":1,
   "time":"2026-03-10T18:51:32.033259",
   "type_uid":300202,
   "user":{
      "email_addr":"ada@read.ai",
      "full_name":"Ada Aiken",
      "uid":"1234567890"
   }
}